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Abstract 

The approximate degree of a Boolean function / : {—1, l} n —> (—1,1} is the minimum degree of a 
real polynomial that approximates / to within error 1 /3 in the norm. In an influential result, Aaronson 
and Shi (J. ACM 2004) proved tight h(n l /:i ) and < d(rt 2/3 ) lower bounds on the approximate degree of 
the Collision and Element Distinctness functions, respectively. Their proof was non-constructive, using 
a sophisticated symmetrization argument and tools from approximation theory. 

More recently, several open problems in the study of approximate degree have been resolved via the 
construction of dual polynomials. These are explicit dual solutions to an appropriate linear program that 
captures the approximate degree of any function. We reprove Aaronson and Shi’s results by constructing 
explicit dual polynomials for the Collision and Element Distinctness functions. 
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1 Introduction 


The e -approximate degree of a Boolean function / : {—1, l} n —>• {—1,1} is the least degree of a real 
polynomial that approximates / to within error e in the norm. Approximate degree is a fundamental 
measure of the complexity of a Boolean function, and has wide-ranging applications in theoretical computer 
science. For example, approximate degree upper bounds underly several of the best known algorithms for 
PAC learning ll24l . agnostic learning I l22ll23l . learning in the presence of irrelevant information B25I1311 . and 
differentially private data release llT9ll44l . Meanwhile, lower bounds on approximate degree imply many 
optimal lower bounds on quantum query complexity, circuit complexity, and communication complexity 
(see for example ll4l 171)177211747133143511401 ). 

In an influential result, Aaronson and Shi proved tight O(n 1 / :i ) and Q(n 2/:! j lower bounds on the approx¬ 
imate degree of the Collision and Element Distinctness functions 110 The Collision lower bound matched 
an earlier 0(n l,/3 ) upper bound due to Brassard et al. I I 15 1 . while the lower bound for Element Distinctness 
was later shown to be tight by Ambainis I®. 

The Collision lower bound subsequently found many applications and extensions in quantum complexity 
theory; Aaronson recently provided a retrospective overview of these developments |3). Moreover, the 
D(n 2//3 ) lower bound for Element Distinctness remains the best known approximate degree lower bound for 
any function in AC^. 

Aaronson and Shi proved their lower bound for Collision with a symmetrization argument. This style 
of argument proceeds in two steps. First, a polynomial p on n variables (which is assumed to approxi¬ 
mate the target function /) is transformed into a polynomial q on m < n variables in such a way that 
deg (q) < deg(p). Second, a lower bound on deg (q) is proved, typically by applying Markov-Bernstein 
type inequalities from approximation theory. Aaronson and Shi’s proof of the Collision lower bound is a 
particularly sophisticated application of this style of argument. 

The lower bound for Element Distinctness follows from a reduction to the lower bound for Collision. 
This reduction is discussed in Section [5] 

The Method of Dual Polynomials. Despite the many applications of approximate degree in theoretical 
computer science, significant gaps remain in our understanding of this complexity measure, and there are 
many simple functions whose approximate degree remains unknown. The slow nature of progress can 
be attributed in part to the limitations of symmetrization arguments. At an intuitive level, the process of 
symmetrization is inherently lossy: by turning a polynomial p on n variables into a polynomial q on rn < 
n variables, information about p is necessarily thrown away. Hence, several works have identified that 
an important research direction is to develop techniques beyond symmetrization for lower bounding the 
approximate degree of Boolean functions Il2l fl7l[38l . 

The last few years have seen significant progress toward this goal. In particular, a series of works has 
proved new approximate degree lower bounds for important classes of functions by constructing explicit 
dual polynomials, which are dual solutions to a certain linear program capturing the approximate degree of 
any function. These polynomials act as certificates of the high approximate degree of a function. Moreover, 
strong LP duality implies that the technique is lossless, in contrast to symmetrization. That is, for any 
function / and any e, there is always some dual polynomial <f> that witnesses a tight approximate degree 
lower bound for /; the challenge is to construct cf>. 

This “method of dual polynomials” was recently used to resolve the approximate degree of the AND-OR 
tree II17II37I1 . closing a long line of incrementally larger lower bounds If6ll2 11I281I381I391 . It has also been used 

'Aaronson established a lower bound of (((n 1 / 5 ) for the Collision function in a paper that appeared in STOC 2002 (T), and Shi 
improved it to the tight t2(n 1//3 ) in a FOCS paper that same year 1391 . A joint journal paper appeared in 2004 (4). The proof was 
simplified and extended to the “small range” case by Kutin 1261 . Ambainis 0 independently extended Aaronson and Shi’s lower 
bound to the small range case, using different techniques than Kutin. 
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to establish several “hardness amplification” results for approximate degree iT81l8~2l[431 . and to prove new 
threshold degree lower bounds for several important classes of functions, including the intersection of two 
majorities 129113811 and AC® ll32l . The latter result represented the first superlogarithmic improvement over 
Minsky and Papert’s seminal f)(n l/3 ’) lower bound from 1969 on the threshold degree of an AC® function. 
We also note that dual polynomials have recently been used to resolve several longstanding open problems 
in communication complexity, where they yield explicit distributions under which various communication 
problems are hard (see the survey of Sherstov lf33lO . 

Contribution and motivation. We reprove Aaronson and Shi's results by constructing explicit dual poly¬ 
nomials for the Collision and Element Distinctness functions!! First, we give a direct construction of a dual 
polynomial for Collision. In Section [231 we give an overview of the ideas that go into this construction. We 
then show how to turn any dual polynomial 'ip for Collision into a dual polynomial ip for Element Distinct¬ 
ness. We construct tp(x) by averaging ip(y) over a carefully constructed set of extensions from each x to a 
longer input y. 

We have two main motivations for reproving Aaronson and Shi’s lower bound in this manner. First, 
only a handful of techniques are currently known for the construction of dual polynomials, especially for 
the case where e = 0(1). To date, dual polynomials have been constructed only for symmetric functions 
11171141 11 and a handful of highly structured block-composed functions IT7lll81l321l36lj38l (a block-composed 
function F : {—1, l} M Ar —> {—1,1} is a function of the form of the form F = g(f{x i),..., /( xm )) for 
some g: {—1,1} M — > {—1,1} and /: {—1,1}^ — > {—1,1}). The Collision and Element Distinctness 
functions fall into neither category; our constructions of dual polynomials for these problems introduce 
several new techniques that we hope will prove useful in future applications. 

A second motivation is to shed new light on the Collision lower bound itself. The earlier symmetrization- 
based proof J4l[26l, while shorter than ours, is non-constructive and relies on Markov-Bernstein inequalities 
from approximation theory. In contrast, our proof is constructive and entirely elementary. We also believe 
that our analysis illuminates some of the more miraculous aspects of the earlier symmetrization-based proof 
- see Section 1231 for further discussion of this point. 

Related work on quantum query complexity. Aaronson and Shi’s original motivation for studying the 
approximate degree of the Collision function was to understand its quantum query complexity (recall that 
approximate degree provides a lower bound on quantum query complexity iflOl . However, it is known that 
the lower bound is not always tight 0). Subsequent to Aaronson and Shi’s work, other methods were 
developed for quantum query complexity (5l|7][9ji20l|42l|47l, and it is now known that one of these methods, 
called the negative-weights adversary method |[20l . is always tight. 

The negative-weights adversary method for lower bounding quantum query complexity is closely analo¬ 
gous to the method of dual polynomials for approximate degree: the former is characterized by a semidehnite 
program, and a solution to this semidehnite program is known as an adversary matrix. A recent line of work, 
similar in spirit to our own, has proved or reproved optimal quantum query complexity lower bounds for 
several functions by constructing explicit adversary matrices. In particular, Belovs and Rosmanis lfl3l con¬ 
structed an optimal adversary matrix for the Collision function in the “large range” case (note that the dual 
polynomial that we construct applies even in the “small range” case), and Belovs and Spalek constructed an 
optimal adversary matrix for the Element Distinctness function lfl4l . 

Very recently, Zhandry li46l (improving on work of Yuen 1 1431 ) has also proved a tight lower bound of 
D(A r1 / 2 3 ) on the quantum query complexity of Ending a collision in a randomly chosen function. 

2 Like Kutin’s simplification and refinement of Aaronson and Shi’s original proof of the Collision lower bound, our construction 

yields a dual polynomial for the Collision function even in the “small-range” case. 
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2 Preliminaries 

2.1 Notation 

For any positive integer n, we denote the set {1,..., n} by [n], and the set {0,1,, n} by [[n]]. For 
a function / : D — >• R, define the L\ norm \\f\\i = c eD \f( x )\- F° r any subset S C [n], we let 
Xs '■ {—1, l} n —>• {—1,1} denote the parity function on S, i.e., Xs( x ) = rites x i- 

2.2 Approximate Degree and its Dual Characterization 

Let D C {—1, l} n , and let /: I) —y {—1,1} be a partial Boolean function defined on D. A real polynomial 
p: {—1, l} n —y {—1,1} is said to e-approximate / if 

1. \p(x) — f(x) | < e for all x € D, and 

2. \p(x)\ < 1 + £ for all x € {—1, l} n . 

The e-approximate degree of /, denoted deg e (/), is the minimum degree of an e-approximation for 
/. We use deg(/) to denote deg 1 / 3 (/), and refer to this quantity without qualification as the approximate 
degree of /. The choice of 1/3 is arbitrary, as deg(/) is related to deg £ (/) by a constant factor for any 
constant e € (0,1). 

Given a partial Boolean function /, let p be a real polynomial that attains the smallest e subject to the 
constraints above, over all polynomials of degree at most d. Since we work over x €= { — 1, 1}”, we may 
assume without loss of generality that p is multilinear with the representation p(x) = c sX.s( x )-, 

where the coefficients cs are real numbers. Then p is an optimum of the following linear program. 


min 




such that 

/(®) - E|S|<d c SXs(a:) 

< £ for each x € D 


E|5|<d c 5Xs(^) 

< 1 + e for each x € {—1, l} n \ D 

c s e l 


for each Sj < d 

£ > 0 




The dual Iinear program is as follows. 


max T.X&D H x )f( x ) - E*e{-l,l}»\13 l<K X )l 


such that E*e{-I,i}" = 1 


Exe{-t,i}» H x )xs( x ) = 0 

for each |5| < d 

<f>(x) € R 

for each x € {—1, l} n 


Strong LP-duality thus implies the following dual characterization of approximate degree: 

Theorem 1. Let f : D —>• { — 1,1} be a partial Boolean function. Then deg e (f) > d if and only if there is 
a polynomial f: { —l,l} n —>■ M such that 

f( x )<i>( x )- h{x)\>£- i^( x )i> 

xeD ire{-l,l}"YD xel-l.l } 71 

and 

Y 4>( x )xs( x ) = 0 for each \S\ < d. (2) 

x£{-l,l} n 
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If <p satisfies Eq. ([TJ, we say that & has correlation greater than e with /. If <!> satisfies Eq. d2]), we say 
0 has pure high degree d. We refer to any feasible solution 0 to the dual linear program as an (e, d)-dual 
polynomial for /. 

2.3 The Collision and Element Distinctness Functions 

Let [iV] = {l,...,iV}, and fix a triple of positive integers n,N, R such that R> N, and n = N -log 2 R. For 
simplicity throughout, we assume that R is a power of 2. The Collision and Element Distinctness functions 
are typically thought of as properties of functions mapping [N] to [R]. However, it will be convenient for 
us to think of them instead as functions on the Boolean hypercube { — 1, l} n . To this end, given an input 
x € { — 1, l} n , we interpret x as the evaluations of a function g x mapping [N] —>• [R]. That is, we break x 
up into N blocks, each of length [~log 2 R\, and regard each block x t as the binary representation of g x (i). 

Definition 2 (Collision Function). A function g x : [N] — » [R] is said to be k-to-1 if for every i € [N], there 
exists exactly k — 1 values j f i such that g x (i ) = g x (j). Let T \ := {x € { — 1, l} n : g x is k-to-1} (clearly, 
Tj. is non-empty only if k\N). The Collision function, which we denote by Col ; y. r, is the partial Boolean 
function defined on T\ U T 2 C { — 1, l} n such that Co\n,r(x) = 1 if and only if x € T\. That is, Co\n,r 
is the partial Boolean function corresponding to the property that g x is a 1-to-l function, with the promise 
that g x is either 1-to-l or 2-to-l. 

Definition 3 (Element Distinctness Function). The Element Distinctness function, denoted EDjy,ij, is the 
total Boolean function defined such that ED ; y /- 1 >(x) = 1 if and only if g x is 1-to-l. That is, EI) y /-,> is the 
total Boolean function corresponding to the property that g x is 1-to-l. 

Let 6c{-l, 1}" denote the set of inputs x such that g x is neither 1-to-l nor 2-to-l. Then an (e, d)-dual 
polynomial f for Col n,r has the following properties (cf. Section [T2l ): 

!■ ExeT! ^(*) - E x&t 2 4>{x) - E xgb l^(*)l > e • Ese{-I,i}" 

2 - E*g{-i,i}" x )xs{x) = 0 for all \S\ < d. 

Similarly, an (e, d)-dual polynomial for EI) yy,> satisfies: 

!■ Ex-eT! ^ x ) ~ Y, xm <l>(x) > £ ‘ E*e{-i,i}” l^( x )l- 

2. E*e{-i,i}» x )xs(x ) = 0 for all \S\ < d. 

2.4 Overview of the Symmetrization-Based Proof of the Collision Lower Bound 

Kutin’s simplified proof of the Collision lower bound l26l proceeds in two steps. The first step is a sym- 
metrization step, which establishes the following remarkable result (we state this result slightly informally 
in this overview). 

Lemma 4 (Informal version of Lemma|5]). Call a triple ( m,a,b ) valid if a\m and b\(N — m). For any triple 
(m, a , h), let R m , a ,b denote the set of inputs x € {—1, l} n such that g x : [iV] —>• [R] maps m of its inputs to 
\R in an a-to-1 manner, and maps the remaining N — m of its inputs to [7i'| in a b-to-1 manner. Then there 
is a trivariate polynomial P of total degree at most d such that for every valid triple (m, a, b), it holds that 
P(m, a, b) = E x&Rrn a b \p(x)]. 
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Note in the above lemma that the sets R m ,a,b are not uniquely determined; for instance Rm., 1,1 = 
i?o,o,i = -Rat, 1,6 = T\ for every triple (m, a, b). 

The second step of Kutin’s proof argues that if p is a (l/3)-approximating polynomial for the Collision 
function, then P must have degree Q(A rI,/;i ). Hence by LemmalU p must have degree Q(A r| / 3 ) as well. 

In more detail, the second step of Kutin’s proof proceeds via a case analysis. Four cases are considered. 

• The first is: P(N/2, 1, 2) > 1/2, and \P(N/2, 1, b)| <2 for all b € [AF 2 / 3 ]. In this case, Kutin is able 
to apply Markov’s inequality from approximation theory to conclude that the degree of P in its third 
variable is H(AT 1 / 3 ). 

• The second is: P(N/2, 1, 2) > 1/2, and \P(N/2, 1, 6)| >2 for some b € [AT 2 / 3 ]. In this case, Kutin 
is able to apply Bernstein’s inequality from approximation theory to conclude that the degree of P in 
its first variable is Q(A r|/3 ). 

• The third is: P(N/2, 1, 2) < 1/2, and \P(N/2, a, 2)| <2 for all a € [AT 2 / 3 ]. In this case, Kutin is 
able to apply Markov’s inequality to conclude that the degree of P in its second variable is Q(A r1 / 3 ). 

• The fourth is: P(N/2, 1, 2) < 1/2, and |P(AT/2, a, 2)| >2 for some a € [AT 2 / 3 ]. In this case, Kutin 
is able to apply Bernstein’s inequality to conclude that the degree of P in its first variable is Q(A r1 / 3 ). 

A key technical complication that must be dealt with in the argument above is that |P(m, a , b) | may be much 
larger than 1 for invalid triples (m, a, b). This may seem like a minor technicality, but in fact it is a central 
issue: if P(m, a, b) were bounded for all invalid triples, then it would be possible to argue that the total 
degree of P is Q(A r1 / 2 ), which would imply a (false) lower bound of Q(A rl,/2 ) on the approximate degree 
of Col n,r- 


2.5 Overview of Our Construction for the Collision Function 

Like Kutin’s proof, our construction also makes essential use of LemmalU Whereas Kutin used Lemma[4]to 
reduce to a setting where Markov-Bernstein inequalities could be applied in a non-constructive manner, we 
instead use Lemma[4]to argue that the dual polynomial o that we construct has pure high degree Q(A r|/3 ). 

In more detail, we present our construction in two stages, in order to highlight distinct ideas that go into 
the proof. In the first stage, we construct a simpler dual polynomial 6: {—1, 1}" —> {—1,1} that exhibits 
an H(i/log N/ log log N) lower bound on the approximate degree of Col n,r- The second stage constructs 
a dual polynomial ijj exhibiting the optimal Q(A rl / 3 ) lower bound. 

Overview of the first stage. Let Hk C {—1, l} n denote the set of inputs of Hamming weight to. The 
symmetrization-based proof of the Collision lower bound from ||4]|26ll carries the strong intuition that the 
sets 7), should play the same role that ///,. plays in Nisan and Szegedy’s seminal symmetrization-based 
lower bound for the OR function Ii28l . We direct the interested reader to Aaronson’s lecture notes nan 
for a detailed explanation of this intuition. The construction of our simpler dual witness </> instantiates this 
intuition in the dual setting. 

Recall that a dual polynomial witnessing the fact that deg(Col ; vy/) > d must satisfy two properties: 
(1) it must have correlation greater than e with CoIat,_r, and (2) it must have pure high degree at least d. We 
define 0 in a way that mimics the structure of known dual witnesses for symmetric functions, even though 
(f) is not itself symmetric. Specifically, our construction ensures that the analysis establishing Properties (1) 
and (2) becomes similar to the analyses of known dual polynomials for the OR function lll7ll4lil . 

In more detail, our prior work fTTIl built on work of Spalek li4ll to give a dual witness 7 for the fact that 
deg e (OR n ) = Of y/n) for any constant e < 1; moreover, 7 places non-zero weight only on sets ///,., for 
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values of k equal (up to scaling factors) to perfect squares. The pure high degree of 7 is shown to be equal 
to (at least) the number of sets Hf. upon which 7 places non-zero weight. 

Call an input x € {—1, l} n valid if it is in R m ,a,b for some valid triple (m, a, b). By analogy with 7, the 
dual witness cp that we construct in Stage 1 places weight only on inputs x 7 7). for divisors k of N that are 
also (up to scaling factors) perfect squares. In particular', our definition of (p ensures that: 

<p(x) = 0 for all invalid inputs x. (3) 

We are able to combine Eq. © with Lemma[4]and a basic combinatorial identity (cf. Lemma[9]) to show 
that the pure high degree of (p is at least |Sj, where S denotes the set of T/,’s upon which (p places non-zero 
weight. Moreover, our definition of cf> is carefully chosen to ensure that its correlation with Coljv,ii is large: 
the precise calculation is closely analogous to the analysis from IT7ll4ll showing that 7 is well-correlated 
with the OR function H171I411I . 

Overview of the second stage. In the second stage, we construct a dual polynomial ip that exhibits the 
optimal Q(A r| / 3 ) lower bound. Rather than only weighting inputs in 7), for some some divisors k of n, ip 
weights inputs in R m ^ a ,b for many valid triples (m, a, b ). There are two key ideas that go into the construction 
of ip. 

The first idea is to define ip as the sum of two simpler dual polynomials 1 pi and ip 2 , each with pure high 
degree N 1 / 3 ) - then the sum ip also has pure high degree ST(A r 1 / 3 ) (see Lemma [151). The first polynomial 
ipi places a large constant fraction (close to 1/2) of its L\ mass on Tj, whereas ip 2 places a large constant 
fraction of its L\ mass on T 2 . Neither ipi nor ip 2 is well-correlated with Co1jv,r in the sense of Eq. ©. 
However, they each place a constant fraction of their L \ mass on i?jv/ 2 , 2 ,i> ar| d they are designed so that 
their values exactly cancel out on inputs in -ffjv/ 2 , 2 , 1 - This allows us to show that ip = ipi + ip 2 satisfies 
Eq. ©, even though ip\ and ip 2 individually do not. 

The second idea goes into the construction of ipi and ip 2 themselves. Specifically, we think of ip\ and ip 2 
as each being constructed in a two-step process. We focus on ipi in this discussion, since the construction 
of ip 2 is similar. Very roughly speaking, in the first step, we consider a “polynomial” ip' of pure high degree 
H(A rl ' /3 ) that places a large constant fraction of its L\ mass on Xj; the construction of ip' is closely related 
to our construction of the simpler dual polynomial cp from Stage 1. 

The reason we place the term “polynomial” in quotes above is that there is an important technical 
caveat to our construction of ip': we think of ip' as placing weight on sets Rm/ 2 .o. 1 for many invalid triples 
(At/2, a, 1), in addition to some valid ones. Of course, if (At/2, a, 1) is invalid, then Rjv/ 2 , 0,1 = so 
ip' cannot place non-zero weight on the set. To address this issue, in Step 2, we add to ip' a bunch of 
polynomials ip" N j 2 a 1? each of pure high degree Q(A rl / 3 ). For each invalid triple (At/2, a, 1), ip" N j 2 a \ i s 
specifically constructed to cancel out the weight that ip' “places” on R^/2,a.i- 

Analogously to how our constructions of cp and ip' were closely related to the dual witness for OR 
constructed in our earlier work iflTI . our construction of ip " N , 2 a , is closely related to a dual witness 7 for 
the Majority function, MAJ, that we constructed in the same work. Each ip" N j 2 a , places additional non¬ 
zero mass on (non-empty) sets of the form R m ,a, 1 for some a / 1 and m £ [N], but we are able to show 
that the total mass placed on such sets is small, using an analysis closely related to the analysis of 7 from 
113. Hence we are able to show that ipi = ip' + ^invalid triples (jv/ 2 , 0 , 1 ) V’jv /2 a 1 places a large constant 

fraction of its L\ mass on Tj. 

2.6 Discussion 

On Kutin’s second step. Our construction of the optimal dual witness ip for the Collision function mimics 
the second step of Kutin’s symmetrization argument in three important ways described below. We find this 
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mimicry to be somewhat surprising - in our earlier work lfl7l . we constructed an optimal dual polynomial 
for symmetric Boolean functions that bore little relation to Paturi’s well-known symmetrization-based proof 
of the same result OOl . We believe that this mimicry sheds new light, or at least gives a new perspective, on 
why Kutin’s proof takes the structure that it does. 

Recall that the second step of Kutin’s proof (cf. Section 12.41) proceeds via a case analysis. The first 
“branch” in the case analysis depends on whether the expected value of the assumed n-variate approximation 
p to Coljv,i? on the set Pm/ 222 . i is large or small. This is mimicked in our construction of p as a sum of two 
dual polynomials p\ and p 2 , both of which individually place a lot of weight on R/v/ 2 , 2,1 > but whose sum 
places zero weight on Rn/ 2 , 2 ,i- 

The second “branch” in Kutin’s case analysis depends on whether |P(iV/2, a, 1)| or P(N/2. 2, b)\ is 
small for all a,b < A r2,/:i . He needs to consider this second branch because P(rn. a, b ) is not guaranteed to 
be bounded for invalid triples ( m , a, b ). 

This branch is mimicked in our construction of p\ (respectively, p 2 ) as the sum of a single “polynomial” 
p' that tries to place weight on sets Rjv/ 2 ,a, 1 for invalid triples (N/ 2, a, 1) (respectively, (N/ 2, 2, b)), and 
many other polynomials p" N / 2 a 1 (respectively, P'P/ 2 2 iP one f° r eac b invalid triple (N/ 2, a, 1) (respec¬ 
tively, (N/2. 2, b )). In our dual setting, the reason we need to incorporate the polynomials p" N , 2 a 1 is to 
cancel out the weight that p' tries to place on invalid sets Pm / 2 m. 1 ■ 

Finally, recall that Kutin applied Markov’s inequality from approximation theory in two of the four 
cases considered in his analysis, and Bernstein’s inequality in the other two cases. Markov’s inequality 
underlies Nisan and Szegedy’s standard symmetrization-based proof that the approximate degree of OR is 
Pl(y/n) ll28l . while Berstein’s inequality underlies Paturi’s proof that the approximate degree of MAJ is 
fi(n) lf30l . This is mimicked in our construction of p\ and A 2 as the sum of p' and the p" N j 2 a 1 and P'^/o 2 b 
polynomials: the construction of p' is closely analogous to the dual witness for OR from IfTTl . while the 
construction of the p" N j 2 a , and p" N / 2 2 h polynomials is based on the dual witness for MAJ from IfTTl . 

On the first step, or why k- to-1 inputs matter. As noted by several authors (e.g., El Slide 36]), the most 
miraculous element of the symmetrization-based proof of the Collision lower bound is the first step (cf. 
Lemma 0}. The crux of this step is to establish, roughly speaking, that for any n-variate polynomial p of 
total degree d, the function P(k) := E x <zT k \p( x )\ is a polynomial in k of degree at most d. Why should this 
hold? More basically, why should inputs that are A:-to-1 even play a prominent role in the proof? 

We provide some partial intuition for this in Section [6] Specifically, we explain that there is an (asymp¬ 
totically) optimal approximation p for Col m,r such that A:-to-l inputs correspond to constraints that are 
made tight by the solution corresponding to p in the primal linear program of Section 12.21 Hence, com¬ 
plementary slackness suggests that there should be a corresponding dual witness p that places weight only 
on inputs that are fc-to-l, or nearly so, justifying the prominent role that A;-to-1 inputs play in both the 
symmetrization-based proof and our new dual proof. 

2.7 Formal Statement of Lemma 0] 

Following Kutin ll26l . we define a special collection of functions which are a-to-1 on one part of the domain 
and 6-to-1 on the other part. For N > 0, recall that a triple of numbers (m,a,b) is valid if ajm and 
b | (N — m). For each valid triple (m, a, b ), we define 

J [i/a] if 1 < i < m 

^ m,a ' h — L(AV — i)/b\ if m < i < n. 

Moreover, for each valid triple ( m,a,b ), we define a set R. m . a .b that is the orbit of g rn .a.b under the 
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automorphism group Sn x Sr. Namely, 


^ Rm,a,b '' '' 3(7 G S/v, T G S/j . T O g x O (J Qm,a,b- 

Note that the sets R m ,a,b are not uniquely determined; for instance | i = R 0 ,a,i = -Rjv,i,& = T\ for 
every m, a, b. 

Lemma 5. Let p(x) be a real polynomial over {—1, l} n of degree d. There is a trivariate polynomial P of 
degree at most d with the property that for all valid triples (m, a, b), 

P(m, a, b) = E xeflmi 0 il ,[p(x)]. 

The statement of Lemma [5] differs slightly from the corresponding lemma in Kutin’s work |26l (Lemma 
|7]below). Lenrma[5]follows by combining Kutin’s formulation with the following simple lemma from [fT 8 l . 

Lemma 6 (lfT 8 lO. Let p be a polynomial over { — 1, l} n . Consider the map T : {—1, l} m —>• {0,1}^'^ 
defined by Tij (x) = 1 if g x (i) = j, and Tij (x) = 0 otherwise. Then there is a polynomial q: { 0,1}^'^ —>• R 
with degq < degp, such that q(T(x )) = p{x) for all x G { — 1, l} n . 

Lemma 7 ( l26l ). Let q(t) be any degree dpolynomial in the variables tij. Fora valid triple (m, a, b ), define 
Q(m, a , b) by 

P{m, a, b) =E xeRm a b [q(T(x))}. 

Then P is a degree d polynomial in m,a,b. 

3 An Q (r/log N/ log log N) Lower Bound for the Collision Function 

The following lemma is a refinement of lITTl Proposition 14], which was used there to construct a dual 
polynomial for OR. 

Lemma 8 . There exists a constant C, > 0 such that for all 5 G (0,1) and L > 1, there is an explicit 
uj : {1,..., L} —> R with 

1 . w(l) > 

2. -w(2) > 

3 ■ ELi \u{k)\ = 1 

4. For every polynomial p : {1,... , L} —>• R of degree d < (y/6L, we have ^/t=i p(k)co(k) = 0. 

The proof will make use of the following simple combinatorial identity, a simple proof of which can be 
found in li29l Appendix A], 

Lemma 9. For any L > 0, let q: R —>• R be a univariate polynomial of degree strictly less than L. Then 

Proof of Lemma [V] Let c = [16/5]. Let m = [y/ (L — 1) /cj and define the set 

T = {1} U {ci 2 : 0 < i < m}. 
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Note that \T\ = £l{yjL/c). Define the function Co : {0,1,... , L} —>• R by 

c m (m!) 2 

'L\ c m (m!) 2 


Co{k) = 


L! 


(k~j) 


- 7 = 


jep]]\r 


iww* _ j) 

0 otherwise. 


if A: G T, 


It is easy to check that u)(0) = 1. 

For k = 1, we have |u>(fc)| = n m / m ; Notice that: 


1 < 


c m (m!) 2 


m .9 

l Z 


- n™i(« 2 -D 


n ,2 


2=1 


n( i+ 52 n 


£exp S 2 ? 


+=i 


< e 8/c <1 + 1(5. 

2 


On the other hand, for k = cl 2 with l > 0, |u>(/c)| equals: 

c m (m!) 2 


( m\y 


{cl 2 - 1) IIie[H]\{<} “ d2 l ( d2 “ n+[[m]]\{£}(* + *)l* - § 

2 ( m !) 2 


< 


(c £ 2 — l)(m + l)\{m — l)\ 
2 


where the last inequality follows because 

( m !) 2 


m 


cl 2 - 1 ’ 


m — 1 


(m +— •£)! m + £ m + £ — 1 


m — l + 1 
m + 1 


is a product of factors that are each smaller than 1. Thus, the total contribution of terms excluding 0 and 1 
to the l\ mass of Co is at most 

yy 2 y* _4_ < 8 < 5 

ci 2 — 1 ci 2 c~ 2 

i =1 i= 1 

Now let b = 0 if \T\ is even, and 6=1 otherwise, and define 1 0 : {1,..., L} —» K via: 

cu{k) = {-l) k+b cu(k-l)/\\Co\\ l . 

Then 

-“ (2) £ “ (1) £ l + Kl)| +< /2 S 2TM ^ V- 

This yields the first two claims about ui. The third claim follows immediately from the definition. Finally, 
let p be a polynomial of degree strictly less than |T| — 1. Then 

1 L 1 / T \ YY1 / a \ 9 1 1 




6 (L\ c m (m!) 2 


fc=i 


k=0 


k L \I 


w 1 


p(fc + l) JJ {k — j) = /, m* 0 » ( 4 ) 


je[[L]]\T 


k=0 


L 
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where 


q(k ) 


(—1 )°c m (m !) 2 


L! I 


w lli 


+ 1 ) 


n - i) 

je[[L]]\T 


is a polynomial of degree less than L. Since q{L) = 0, the right hand side of Eq. © is zero by Lemma|9] 
This gives the last claim. □ 


Our prior work liTTI . building on work of Spalek |4T1 . obtained a dual polynomial 7 for ORl by setting 
the total weight of 7 on inputs in II /. (the set of inputs of Hamming weight k) to be c o(k + 1). In that work, 
the first three properties of oj ensured that 7 had high correlation with OR, while the fourth ensured that it 
had pure high degree Ll{\fL). 

Analogously, our dual polynomial <f> for Col n,r below sets the total weight of 7 on 7). to be co(k). Then 
again, the first three properties of u ensure that f is well-coiTelated with Colyyy and the fourth ensures that 
it has pure high degree 0(\/Z). However, there is the complication that 7). must be non-empty, i.e., k must 
divide TV, for every k in the support of u. To handle this complication, we take TV large enough so that all 
k = 1, 2,... , L divide TV, yielding an H(i/log TV/ log log TV) lower bound. 


Theorem 10. Let N = LI for some L. For 5 > 0, there exists an explicit (1 — 2 5, d ) dual polynomial ffor 
CoIa T t R with d = Ll(s/5L) = Ll(5 log TV/ log log TV). 

Proof. First, notice that k\N for all k € [L\, so T k f 0 for every such k. Define 6(x) = u(k)/\Ti, : if x is 
in T). for some A: € [L\, and <p(x) = 0 otherwise, where u is obtained by applying Lemma [ 8 ] Note that 7(x) 
is well-defined since | Tf. \ 0 for all A: € [L\ , and each * € {- 1 , 1 }™ is in Tfc for at most one value of k. 

We check: 

Y - Y = ~ w ( 2 ) - 1 ~ 

xGTi x£T 2 

where the inequality holds by Parts 1 and 2 of Lemma[ 8 ] Moreover, 

L 

Y W x )i = 

x£B k =3 

where the inequality holds by combining Parts 1-3 of Lemma[ 8 ] Thus, 

Y r ^ x ') “ Y ~ Y l^( x )l > 1 - 2( 5- 

xeTi x&T 2 x&B 


Y i < H x )i = = lj 

xeTiUT 2 U.B k= 1 

where the final equality holds by Part 3 of Lemma[ 8 ] 

Finally, let d = QsfdL where ( is as in the statement of Lemma [ 8 ] and let S C [n] with \S\ < d. We 
must show that X)xeTiuT 2 us ^i x )xs{x) = 0- Note that: 


L L L 

Y H x )xs(x) = YY ^( x )' Xs(x ) = YY ^( k )/\ T k\)-Xs(x) = ^2u{k)-E xeTk [xs(x)], 

XGT 1 UT 2 UB k =1 xeT k k =1 x ETfc k =1 


where the first equality holds because f(x) = 0 if x is not in 7/ ; . for some A: € [L\. 

By Lemma [3 there is a trivariate polynomial P of total degree at most d such that P(m,a,b ) = 
E x( i f im a h [ 75 (.x)] for all valid triples (m, a, h). In particular, since A:| A' for all ke[L\,q(k) := P(N , k, 1) 
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is a univariate polynomial in k such that q(k) = E x£ T k [xs(x)] for a ll k € [L\. Hence, Part 4 of Lemma[ 8 ] 
implies that 

L 

-E xeTk [xs(x)] = 0 . 

k= 1 

□ 


4 An ^(A 1 / 3 ) Lower Bound for the Collision Function 

The following lemma is a refinement of lfl 8 l Proposition 10], which constructed an explicit dual polynomial 
for MAJ. 


Lemma 11. There exists a constant p > 0 for which the following holds. Let 5 S (0,1), N > 0 an even 
integer, and k € [N], Then there is an explicit '■ [[A]] —>• R such that 

1. pk is supported on {2k, Ak,..., 2[N/2k\k} U {N/2} 

2. m (N/ 2 ) > 

3- Er=o\Vk(r)\ = 1 

4. For every polynomial p : {0,..., N} —> R of degree d < ps/SN/k, we have ^^=oP( r )%( r ) = 0- 

Proof Throughout the proof, we assume for simplicity that N/2 is not a multiple of 2k. The analysis when 
N/2 is a multiple of 2k is similar. 

Let c = \-^=] and t = 2 [N / (4fc)J k and define the set 

S = {t± 2elk : 0 < i < [t/ (2cfe)J}. 


Note that |5| = Ll{N/ck). We claim that it si}) := Y\j^s \ j ~ *1 i s minimized at i = t. Notice that 
translating all points in 5 by a constant does not affect ns(i), and scaling all points in S by a constant 
does not affect argmin ): 7 r 9 ('/'). Thus, it is enough to show that ns*(i) is minimized at i = 0 for the set 
S* = {±£ : £ <t}. In this case, its* (*) takes the simple form (t — i)\(t + *)!, and we see that for all i € S*, 

tts*(0) (f!) 2 t t—1 t — |*| + 1 

7 rs*(i) (t — i)\(t + i)\ f+|i| f+|i| — 1 t + 1 

is a product of terms smaller than 1 , so its* (i) is indeed minimized at i = 0 . 

Now let T = S U {t — 2k, N/2} and define the function 


r)( r ) 


N\ (2ck) 2h (h\) 2 {2k)(N/2 - t ) 

r) W\ 


II ( r “ 3) 

mm]\T 


(2ck) 2h (h\) 2 (2k)(N/2 —t) 

UjeT\{v}( r ~ j) 


where h = [t/2ck\. The normalization is chosen so that = 1. 

The reason that we include both (r — (t — 2k)) and (r — (N/2)) in the denominator of fj is to ensure 
that the rate of decay of f)(r) is at least quadratic as r moves away from t. This will ultimately allow us to 
show that a large fraction of the t\ mass of fj comes from the point r = N/2. 
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For r = t — 2k, the mass \r)(r)\ is 


(: 2ck) 2h (h\) 2 (2k)(N/2-t ) = (N/2-t) fr( 1+ 1 \ 

2k(N/2-t + 2k)]\ h l=l (2ckl-2k)(2ckl + 2k) N/2-t + 2kjJ^\ (c£) 2 - 1J 



1 + 5 


where the first inequality holds because N/2 — t < 2k, combined with the fact that n! =i (1 + a f) < 
exp(]>/j ' =1 ai) for nonnegative a^. 

For r = N/2, we get 


_ (2ck) 2h (h\) 2 (2k)(N/2 — t) _ 

(N/2 - t)(N/2 -t + 2k) nti(2cM + [N/2 - t))(2ekl - (N/2 - t)) 

_ 2 fc I r f _(2 cfcl) 2 _\ 1 

“ N/2 -t + 2k 11 ^(2 ckl) 2 - (N/2 - t) 2 ) ~ 2' 


Now we analyze the remaining summands, and show that their total contribution is much smaller than 
1. Recall that the choice % = t minimizes irs(i), and that "sit) = (2 ck) 2h (h\) 2 . Therefore, 

= (2 C fc)^(^!)^(2fc)(JV/2 -t) 2k(N/2 - t) 1 

n, 6 T\{( + 2 C M)l‘ + 2 cM-il " \2ckt + 2k\\2dd-{N/2-t)\ ~ <?P - 1 ’ 

where the final inequality exploits the fact that N/2 — t < 2k. Similarly, 


_ = (2ckr(h<n2k)(N/2 - t) 2k(N/2 - 1) l 

YljeT\{t+ 2 cke}\ t ~ 2ckt - j\ \2ck£ — 2k\\2ck£ + (N/2 — t)\ c 2 £ 2 — 1 

We can use this quadratic decay to bound the total i\ mass of the points outside of {t — k, t, N/2}: 

E , a , . . ^—v 1 2 7 T 2 5 

l’'«ISLppTT) T < 2' 

jes\{t} tyo v > 

Now let rjk(r) = (—l) r+h+N / 2 fi(r)/\\r)\\i. Since fj is supported on T C {2k,4k,... ,2[N/2k\k} U 
{iV/2}, the function r/fc is as well, giving the first claim. Moreover, 

, Ar/(A , 1/2 1-5 

Vk ^ I ^ ~ (1/2 +5/2) + 1/2 + 6/2 ~ 2 

This yields the second claim about r/fc. The third claim follows immediately from the definition. Finally, let 
p be a polynomial of degree strictly less than \T\ (where |T| > pN/k for a constant p). Then 
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N 


N 


X] p( r )vki.r ) = 


r =0 


r=0 

N 


(^_-yy+h+N/2 


N 


Ef- 1 )' r «M 


r=0 


JV\ (2ck) 2h {h\) 2 (2k)(N/2 -i) 
r J AH 


II ( r “ 

mm]\T 


for a polynomial q of degree strictly less than N. This is equal to zero by Lemma [9] giving the final 
claim. □ 


We obtain our dual polynomial ip for the Col/v,/? as a linear combination of two simpler functions ip\ 
and ip 2 - These functions have the following properties. 

Lemma 12. Let N > 0 be an integer multiple of 4. For R> N, there exist explicit ipi,ip 2 '- {— 1, l} n —>• R 
and d = Fl^^N 1 ^ 3 ) such that 

L E*eTi Mx) > ^r- 

2 ~ExeT 2 Mx) > ^ 

3. \\ipi\\i = \\ 1 p 2 \h = 1. 

£* g t 2 IV’i(*)l = ExeT! 1^2 (*) I = 0. 

5. Li, L 9 /zave pure high degree at least d. 

6 ■ IEsTi Vh(x) = ExeR N/2 , 2tl Mx)- 
2 Exe% /2A1 ^i(*) = E* g t 2 ^2(x). 

S. ipi and ip 2 are e«c/z constant on each set R m ^ a) b when (m, a, b ) z.v valid. 

Together, they yield the desired dual polynomial for Col m,r- 

Theorem 13. Let N > 0 he an integer multiple of 4. For R > N, there exists an explicit (1 — 6(5, d)-dual 
polynomial ip for Col Nfifor d = L2(<5 1//3 A^ 1 / 3 ). 

Remark 14. The dependence of the lower bound Theorem U3\ on both parameters 5 and N for fr < 6 < d-, 
is tight up to a logarithmic factor in the size of the range. We show this in Appendix \A\ by constructing an 
explicit approximating polynomial for Col/y. n of the appropriate degree, by building on the ideas underlying 
the quantum query algorithm of Brassard et al. I\15\l . 

Proof of Theorem [Til assuming LemmaU2\ Let a = XEeTi ^(x) and let b = Y1 x gt 2 IV , 2 (^)l = — EseT 2 ^(x), 
where ip\ and ip 2 are as in Lemma [T2l Let ip(x) = a/W\ (x) + bip 2 (x). By Property 5 of Lemma fl2l and 
Lemma [15] below, ip also has pure high degree at least d. So we need only show that ip has correlation at 
least 1 — 6(5 with Coljv,R. To this end, note that 

1. ExeTi ' l P( x ) = a 2 > ^ ^ . This inequality uses Properties 1 and 3 of Lemma fl2l 

2. — Ex G t 2 CM = b 2 > . This inequality uses Properties 2 and 3 of Lemma fl2l 
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3 - Exes M*)l < “SxeB\% 2A i \M X )\ + 6 Exes\i? JV /2,2.i \M X )\ ^ (« + &)<*■ Here, the first 
inequality exploits the fact that 


25 IV’(*)I = 25 \a ■ f>i{x) + b ■ f> 2 (x)\ = 0. 

X&Rn/ 2 , 2,1 X&R n / 2 , 2,1 

The last equality in Eq. © holds because, for all x € Rn/ 2 , 2 ,i> 
a ■ il>i(x) + b ■ tp 2 {x) 

= ( 25 V’i(z')] i(®) + (- 51 ^O')] ^2 fa) 

Vx'eTi / V x'er 2 / 

55 V^fa') I • ^ifa) + ( - 55 V’lfa') ] ^2 fa) 


^x'G-RiV/ 2 , 2,1 

55 ^oo 

^x'G-RiV/ 2 , 2,1 


\Rn/2,2,i\ , „ 

X fc-TCjv/2,2,1 


ai'G-Rjv/ 2 , 2,1 

55 w) 1 +1 - 51 ^ifa') 


(5) 


x'£R N / 2,2,1 


|-RjV/2,2,ll _ ;< - r 

at titjv/2,2,1 


55 ^fa') 


= 0 , 


where the second equality exploited Properties 6 and 7 of Lemma |T2j and the last equality exploited 
Property 8. 

Thus, the correlation of f with Co\n,r is 

25 V’fa) - J 5 V’O) - 25 l^(*)l >a 2 + b 2 -(a + b)S 

x&Ti x£ T 2 x£B 

>l-28>(l-66)-U\\ 1 , 

where the final inequality holds because IIV’lli < a 2 + b 2 + (a + b)5 < \ + 5. □ 

Lemma 15. Let if>i, 1^2 ■ {—1, l} n —> {—1,1} each have pure high degree at least d. Then ip = if + if 
also has pure high degree at least d. 

Proof. Let S C [n] with |5| < d. Then 

25 ^( x )xs(x) = 25 VhOzOxsO) + 25 ^(aOxsfa) = o. 

ze{-i,i} n xG{-i,i} n xej- 1 , 1} 71 


□ 


Proof of LemmaU2\ Let £ be the constant from Lemma [ 8 ] let p be the constant from Lemma fTTl and let 
S' = 1/2. Set K = 2(pN/Q 2 / 3 (5'/8) 1 / 3 . Let d = ^p 1 / 3 C 2/3 {5') 1/6 S 1 / 3 N 1 / 3 = Hfa^iV 1 / 3 ), noting that 
d < ((5/8) 1 / 2 K 1 / 2 and d < p(S') 1 / 2 N/k for every k < K. Let ur. {1,... ,K} M, with correlation 
constant 5/ 8 , and 773 , .... r/y : {1,..., N} —>• M, with correlation constant S', be as in the conclusions of 
those lemmas. 

We start by defining a function T (rri. k) as follows. 


V(m,k) = u(k) ■ t m =N/2 


u{k) 
Vk(N/ 2 ) 


lfc >3 • Vk(m). 
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Here, 


1 if m = N/2, 
0 otherwise, 


1 ifk> 3, 

0 otherwise. 


1 


m=N/2 


and 


lfc>3 = 


We first show how to use 'h to construct the polynomial tp\. Analogously to our construction of <i>, we 
want r ip i to place a total weight of T(m, a) on each set R m ,a, i- Recall from our overview in Section [231 
that we think of i/h = + ^invalid triples (jv/ 2 ,a,i) ^N/2,a,i’ where $ looks like the sim P ler “ first stage” dual 

polynomial ([> from our informal overview (which we constructed in Section [3]) and each a \ cancels 
out the weight <p places on values of k the do not divide N. This structure underlies our construction of T, 
where we add multiples of the polynomials r]k(m) to cancel out the weight u(k) places on invalid triples. 

Now we construct and analyze the polynomial tpi. Define 




'^(m,k)/\R mA i 
< *(JV/2,l)/|Ti| 

0 


if X £ Rm,k, 1 \ T\ 
if x € Tp 
otherwise. 


Notice that ipi is well-defined, because any x 0 T\ is in R m ,k, l for at most one triple (m, k , 1). We collect 
several calculations with tp\. First, 


and 


£ Mx) = *(N/ 2,1) = w(l) > 

xeTi 

- ^ &(*) =-*(JV/2,2) =-0,(2) >1^?, 

X&Rn/ 2 , 2,1 


£ l^i(*)I = £ |’T(m, k)\ 

x£B\R n/2i2a {( m,k ): fc|m}\{(tV/2,l),(tV/2,2)} 

K ( . \.N/2k\ 

u[k) 


E 


Vk(N/2) 


k =3 

K 

< 4£|w(A;)| 

k =3 


£ \Vk(2ki) 


i=1 


- 2 ’ 


where the penultimate inequality exploits Properties 2 and 3 of LemmaQTj and the final inequality exploits 
Properties 1-3 of Lemma[ 8 j 

Noting that |cu(l)| + |w(2)| < 1, it follows that ||^i||i < 1 + 5/2. So setting tpi = ^i/||'0i|| i, it is 
immediate that tpi satisfies the first three properties in the statement of the lemma. tp\ also satisfies the 
fourth property, since for any x € T 2 , ipi(x) = T , ( N , 2 )/|? 21 = 0 . 

Now we will show that tpi, and hence tp 1 , has pure high degree at least d. We require two observations. 


• is supported on ( m,k ) for which k\rn. To see this, note first that for any k > 3, T(A r /2, k) = 
oj(k) — ^jv/ 2 ) ‘ Vk(N/2) = 0. The claim now follows from Property 1 of Lemma ITTl combined with 
the fact that 2\N. 

• T (m, 1) is nonzero only for m = N/2, and hence 'Y/ x&Tl ^i(i) = f(iv/ 2 ,i) = ELi®Ki). 
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Fix any S C [n] with ,S'|<d. Let Q(rn. k) be a polynomial of degree at most d — 1 in each variable 
such that, for all pairs (m, k) with k\m, Q(m , k) = k The existence of such a bivariate 

polynomial Q is guaranteed by Lemma [5] Then the previous two observations together imply that: 


N N 

E m*)xs(x) = E E x S'(m,k)Q(m,k). (6) 

xe{-i,i} n "i=i k =l 

We remark that a key point is the derivation of Eq. © is that we have no control over the evaluations 
Q(m, k) when k does not divide m, yet this is rendered irrelevant because T (rn, k) = 0 for all such pairs. 
The right hand side of Eq. © equals: 

K K (k) ( [_N/2k\ \ 

E“(WA‘)-E^ U(NI2)Q(N/2,k) + £ rj k (2ik)Q(2ik,k)\ . (7) 


The first sum in Eq. © is zero by Lemma[ 8 ]since (/{N/2, k) is a polynomial of degree at most d in k. 
The second sum is also zero because for each fixed k, Q(r. k ) is a polynomial of degree at most d in the 
variable r, and hence the term in parentheses is zero by Lemma [IT] (Parts 1 and 4). Thus r ip\ has pure high 
degree at least d. 

The construction of 0 2 is similar. This time, we let 


02 0c) 


ty(m, fc)/|-R m ,fc, 2 

< *(N/ 2,2)/|T 2 | 

0 


if X € Rm,k ,2 \ ^ 2 
if x e T 2 
otherwise. 


Note that ' 1 P 2 is well-defined, because any x (/ 74 is in R m ,k ,2 for at most one triple (rn, k, 2 ). We define 
'02 = 02 /11 02 ||i- Showing that 02 satisfies Properties 1-4 of the lemma follows from the same calculations 
we used for 0 i. 

To show that 02 has pure high degree at least d, we require the following additional observations. 

• 4» is supported on pairs (m, k) for which k\rn and 2|(iV — m). To see the latter property, note that if 
^(m, k) / 0, then m is even (this holds because N/2 is even, which follows from our requirement 
that N is a multiple of 4), and hence N — m is as well. 

• ^(m, 2) is nonzero only for m = N/2. It follows that Y1 x gt 2 02 (x) = &(N/ 2,2) = t^ , ( m )2)- 

With these observations in hand, showing that 02 has pure high degree d then follows from calculations 
analogous to the ones we used for 0 i. 

Finally, the fact that 0i and 02 satisfy Properties 6 , 7, and 8 of the lemma follows from their defini¬ 
tions, combined with the fact that Rn/ 2 ,i ,2 = Rn/ 2 , 2 , 1 - I n f act > SzeTi 0i( x ) equals 4 / (iV/2, 1 ), while 
ExeRjv /2 2 ! ^ 2 ( x ) also e q uals ^(iV/2,1), giving Property 6 . Similarly, Y^ x &t 2 02 0*0 equals ^(iV/2,2), 
while Y1x&r n / 2 12 0’ 1 ( x ) a ^ so equals T'(A^/2,1). This completes the proof. 

□ 


5 A Dual Polynomial for Element Distinctness 

We first recall the reduction from Collision to Element Distinctness given in JHH The reduction shows how 
to turn a polynomial p approximating ED m,r into a polynomial q approximating Col at , r, with N ~ M 2 
and deg q < deg p. 

3 While the reduction given in Aaronson and Shi’s paper is stated in terms of quantum query algorithms, it is straightforward to 
rephrase the reduction in terms of approximating polynomials instead. 
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We illustrate the reduction for N = M 2 / 12. Let p : { — 1, l} m —>• {—1,1} be an (l/ 6 )-approximation 
of ED m,r, with rn = M log R. Define a polynomial q : {—1, l} n —>• {—1,1} for n = N log R by 


q{yi,---,VN) 





That is, q(y) is the expected value of p(x) where x is the concatenation of a random subset of M of the 
blocks y u ...,y N . To simplify notation, for a set S = {h,i 2 , ■ ■ - Dm}, let y\ s = (yh,yi 2 ,- ■ ■,Vi M )• Note 
that degg < degp. Moreover, since q is an average of values in [—7/6, 7/6], it is always in [—7/6, 7/6] 
itself. To finish arguing that q is a (1/3)-approximation to Coljv,i?, we consider two cases: 


1. If y £ Ti, i.e., y is a 1-to-l input, then y\s is always 1-to-l. Hence p(y\s) F [5/6, 7/6] for every 
subset of indices, so q(y) £ [2/3,4/3]. 

2. If y € T 2 , i.e., y is a 2-to-l input, then with high probability y\$ is not 1-to-l. This follows from the 
“birthday bound”: 

Pr [EB(y\ s ) = 1] < ex P (-Af 2 /41V) < 

\S\=M 12 

Therefore, q(y) < (11/12)(—5/6) + (l/12)(7/6) < -2/3. 


The construction we give in this section takes a dual view of the reduction above. Namely, we show 
how to transform a dual polynomial i/j for Coljv,i? into a dual polynomial <p for ED \f./f, with M 2 ~ N. In 
the primal reduction, we constructed q(y) from p(x) by averaging p over all subsets of size M. The right 
analogue in the dual reduction is to construct <p{x) by averaging ip(y) over a carefully constructed set of 
extensions from x to a longer input y. In particular, <p(x) averages 'tp(y) over all y for which could have 
been produced by taking a subset of M blocks of y. 

We give this reduction formally below. 

Theorem 16. Let ifi : { —l,l} n —>• { — 1,1} be a (1 — d. (l)-dual polynomial for CoLy./,>. Then %b can 
be used to construct tp : {—1, l} m —>• {—1,1} that is an (1 — 2 5,d)-dual polynomial for ED \/./-,> when 
M > 2 y / N\og(2/d). 

Corollary 17. For any 5 > 0, there is an explicit (1 — 5, d) -dual polynomial for EDm,r with d = 
fl((S/ log (1/8)) 1 ! 3 M 2 / 3 ). 

Remark 18. The dependence of Corollary\l7\on 5 is essentially tight for 5 = 0(M -2 ). See Appendix\A\for 
details. 

Proof of Theorem 17771 Given a set S’ = {i\..... } c [N] with i\ < i 2 < ■ ■ ■ < %m and a bit string y = 

(yi ,..., y^) € { — 1, l} n , define the restriction of y to the set S, denoted by y\$ € {—1, l} m , to be the string 
of length m = M log R obtained by concatenating the blocks y* for i € S, i.e., y |g = (y n , j/j 2 ,..., yt M ). 
Given a bit string x € {- 1 , l} m , define the multiset of extensions of x, denoted by ext(x), to be the 
( A ' x / )/i A A/ strings y £ { —1, 1 }" where y\s = x for some |5| = M. Restrictions and extensions are related 
by the equivalence of the multisets: 

{{x,y) : x € {-1, l} m ,y € ext(x)} = {(x,y) : y G {-l,l} n ,x = y\ s for some |5| = m}. 

For x G { — 1, l} m , define the polynomial 

t( x ) = i Y ^(y)- 

\ m ) yGext(oi) 

Let ip(x) = 0 for x / {—1, l} m - We claim that tp is a good dual polynomial for the Element Distinctness 
function ED, which requires us to show 
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1- £*={- 1 , 1 }"* y ;, (^)ED(a;) > (1 25) • X^xe{_i, 1 } m l < / ? ( x )l 

2 - Exei- 1 , 1}" 1 M x )xs{x) = 0 for all \S\ < d 

To verify the first property, define 

My) = iE E Mv\s). 

\m) \s\=m 


We collect a few observations about A. 

1. | A(y)\ < 1 for all y. 

2. If y G T\, then A(y) = 1. 

3. If y € T 2 , then 

Pr jED(y\ s ) = 1] < exp(-M 2 /4tV). 

\S\=M 

Hence, 

A(y) < -1 + 2exp(-M 2 /4iV) < -1 + 5. 

Therefore we get 


EE ^)ED(s) 

xe{-i,i} m 


7F E E ^(y)ED(s) 

\MJ xg{— l,l} m yEext(x) 

i E E V’(y) ED(y|s) 

Im) j/g{-1,1}« |5|=M 

EE Mv)Mv) 

J/G{-1,1}" 


> 1 EE My) - EE w - EE i^%)i 

j/STi yeT 2 y&B 

>{i-25) EE l^(y)l 

j/e{-i,i}" 

= (i - «) E T^r E IV'(y)l 

j/g{— i,i} n vm; |s|=m 

2 7 IT EE EE \My)\ 

\m) xG{—l,l} m yEext(x) 


> 0 -- 25 ) ee i^i- 

xe{-i,i} m 


- 5 EE l^(y)l 

1 / 6 T 2 
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For the second property, let T be a subset of [N] with |T| < d. Then 


<p(. x )xt( 

a;S{—l,l} m 


X = 


7K V>( v)xt(x ) 

\M) 


xG{— l,l} m j/Eext(x) 


1 


( N ) 

\M) 151 = 


E E ' t P{y)xT{y\s) 

\S\=M yS{—1,1}" 


( N ) Z “ 
\M) 151 = 


E E ^{y)xT\ s {y) 

\S\=M ye{-l,l} n 


= 0 , 


where T\s denotes the subset of T contained in the blocks specified by S. 


□ 


6 On Complementary Slackness 

Recalling that any bounded-error quantum query algorithm can be converted into an approximating polyno¬ 
mial im the collision-finding algorithm of Brassard, Hpyer, and Tapp U5l yields an explicit, asymptoti¬ 
cally optimal approximating polynomial for Col n,r- We describe this polynomial p below. 

Recall that any approximating polynomial for Col at, it represents a feasible solution to the primal linear 
program considered in Section lT2l If the polynomial p were an exactly optimal e-approximation for Co\n,r, 
then complementary slackness would imply that the optimal dual polynomial ip for Col at, it is supported on 
the points corresponding to constraints made tight by p. That is, ip : {—1,1}™ —>• {—1,1} is supported on 
x € {—1, l} n for which \p(x) — Col(.x')| = e. We refer to these as the maximum-error points of p. 

While we do not know whether p is an exactly optimal approximating polynomial for CoIy.r, we might 
still expect that an approximate version of complementary slackness might holds, in the sense that a “good” 
dual polynomial should place all or most of its weight on points that are “nearly” maximum-error points of p. 
Indeed, this intuition has proven accurate for all of the dual polynomials constructed in prior work, including 
for symmetric functions (see fl7l Section 4.5]), block-composed functions (see li43l Section 1.2.4]), and the 
intersection of two majorities ll38l . Below, we argue that A:-to-1 inputs are nearly maximum-error points for 
p, which explains why our dual polynomials for collision are supported on inputs that are roughly A:-to-1, in 
addition to why these inputs play a prominent role in the original symmetrization-based proof. 

An asymptotically optimal approximation p for Col vj,>. For a subset S C [N], define cross.s-: {—1, l} n —>• 
R via: 

cross s (xi,... ,x N ) = \{i e S,j S : Xi = Xj}\ = ^ EQ (xt,Xj), 

i&S,j£S 

where EQ denotes the equality function. That is, cross.s - (.x) counts the number of cross-collisions between 
indices in S and indices outside of S. Notice that EQ(.x,;, Xj) is a function of only 2 • log R variables, and 
hence cross^xi,..., :/;,v) is exactly computed by a polynomial of degree 2 • log R. 

In addition, for a subset S C [N], define the function Urd.,s(.x - ] •..., .x/y) to he 1 if x* ^ Xj for all pairs 
i,j € S with i / j i and 0 otherwise. That is, Ied,s indicates whether x is 1-to-l on the indices in S. Notice 
that Ied,s is a function of only \S\ ■ log R variables, and hence is exactly computed by a polynomial of 
degree IS) • log R. 

For the remainder of the discussion, let r = iV 1 / 3 - we focus on the quantity cross^x) when \S\ = r. 
We will need the following simple observations. 


19 



1. If x G Ti, i.e., x is a 1 -to-l input, then crosss(x) = 0 and Ied,s(®) = 1 f° r an Y &■ 

2. If x G T 2 , i.e., x is a 2-to-l input, then Ied,s(®) = 1 => crosss(x) = r. 

3. If x G T‘ 2 , then, over the random choice of S, Ued..S'(- x ') = 0 with probability at most (N/ 2) • (r/iV ) 2 < 
AT” 1 / 3 . 

4. For all x G { — 1, l} n , Ied,sOf) = 1 ==> crosss(x) < N — r. 


Let T d : R —>• R denote the degree-d Chebyshev polynomial of the first kind. This polynomial has the 
following properties: 

• T d {x) € [-1,1] for x € [-1,1], 

• T d (l + M/d 2 ) > 10 for a constant M independent of d. 

• The extreme points of T d in [—1,1] are the degree-d Chebyshev nodes, which take the form cos(* 7 r/d) 
for 0 < i < d. 


Truncating the Taylor expansion of cos(x) = 1 — x 1 /2 + ... after the quadratic term, one sees that the 
Chebyshev nodes are well-approximated via the expression cos(i 7 r/d) ~ 1 — (ci 2 /d 2 ) for some constant c. 

Applying an appropriate affine transformation to T d , we obtain a polynomial A d with the following 
properties: 

• A d (0) = 1. 

• A d (i) € [—1, —3/4] for all real numbers i G [1, d 2 /M], 

• A d {i) G [—1,1] for all real numbers i G [0 ,d 2 /M\. 

• The extreme points of A d are well approximated by the points c • i 2 for i G {0,1,... , |_d • l//2 J}. 

Letp 5 (x) = Ied,s , (^) • At(crosss(xi,... ,xa r)/r) for d = 100 • M ■ N 1 / 3 , and let 


p(x) = E| S | =r [p s (x)] 


Ps(x). 

\r) |S|=r 


Then p is a polynomial of degree \S\ log R + 2 • d • log R = 0(A rl / 3 log R). We argue that p approximates 
Col a?, ft to error e for some e < 1/3. The analysis falls into three cases. 


Case 1: For x G Ti, ps(x) = A d (0) = —1 for all S, where the first equality follows from Property 1 above. 
So p(x) = E| S | =r [p 5 (x)] = 1. 

Case 2: For x G T 2 , Ied,s(/c) = 1 =>- Ps(%) = At(l) € [—1,— 3/4], where the equality follows from 
Property 2 above. Meanwhile, Ied,s(^) / 1 => Ps( x ) = 0. Combining these two facts with 
Property 3 above establishes thatp(x) = E|£| =r [ps(x)] G [—1, —2/3]. 

Case 3: For x G {—1,1}™, Ps( x ) £ [—1,1]. This follows from Property 4 above. 
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Identifying maximum-error points of p. For any fixed S, the maximum error points of ps are well- 
approximated by the x € {1,1}" for which the following two equations hold: 

cross 5 (x) = c • i 2 ■ r for some i € {0,1,... , [d ■ M -1//2 J} (8) 

and 

Ied,s(®) = 1- (9) 

(This follows from the fact that the extreme points of Ad are roughly of the form c-i 2 for 0 < i < d-M- 1 / 2 ). 

However, the maximum-error points for the averaged polynomial p(x) = E| 5 | =T .[ps(a;)] are the points 
x that satisfy Eq. © and Eq. © with high probability over the choice of S. Indeed, for these points x, the 
eiTor of p(x) is at least e ■ (1 — o(l)) ~ e. 

Consider any k of the form k = c • i 2 + 1 for some i € {0,1,..., [d ■ M -1 / 2 J}, such that k = o(A r1 / 3 ). 
Consider any x € 7}; we claim that x satisfies Eq. © and Eq. © with probability I — o(l) over choice of 
S. To see this, observe that the probability that Ied,s(®s) = 0 is at most ( N/k ) • k 2 ■ ( r/N ) 2 = = o(l). 

And if Ied.sOes) / 0, then the number of cross-collisions is exactly 

crosss(xi,.. .,x N ) = r ■ (k - 1). 

When k takes the form k = c ■ i 2 + 1, this means that x satisfies Eq. ©. Hence, x has nearly maximal error 
even for the averaged polynomial p. 
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A On the Tightness of Theorem [13] and Corollary [17] 

To complement Theorem [131 we construct an approximating polynomial that gives a nearly matching up¬ 
per bound on the approximate degree of Coljv,_R. The construction is a refinement of the approximating 
polynomial given in Section [6] 

Proposition 19. For 0 < 6 < 1/N, there exists a polynomial p of degree 0(<5 1 / 3 A r1 / 3 log II) that (1 — 5)- 
approximates Col/v, r. 

Proof sketch. See Section[6]for the construction of an approximating polynomial of degree (){N ] / :i log R) 
in the case where 5 is constant. In order to obtain an improved upper bound for vanishing 5, we make the 
following changes to that construction: 

1. We instead choose r = J 1 / 3 A r1 / 3 . Now if x is a 2-1 input, the probability over the random choice 
of the set S of obtaining a collision inside S, i.e. the probability that Ied ,5 = 0, is at most (N/2) ■ 
(■ r/N ) 2 < 5/2. 

2. We instead let Ad be an affine transformation of a Chebyshev polynomial with the following properties 
for some constant M: 

• A d (0) > I 

• Adif) € [— 1, — §] for i € [1, d?/M5] 

• Ad(i) € [—1,1] for x € [0, d? /MS). 

3. Setting d = 100 ■ M ■ r ensures that the polynomial p has degree 0(<5 1//3 W 1//3 log R ) and is a (1 — 6)- 
approximation of Coljv,R- 

□ 

We now show that Corollary [17] is tight up to a factor of log R, when 5 < 1/M 2 . This gives mild 
evidence that the lower bound has the right dependence on both parameters M, 5 for vanishing 5. 
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Proposition 20. Let 5 < 1/M 2 . Then there exists a (1 — 5)-approximating polynomial for ED^fi with 
degree 0(log R). 

Proof. We write 

ED M ,i?(xi,..., x M ) = f\ NEQ(x,, Xj), 

where NEQfxj, xf) = 1 if i and inputs j are distinct, and is zero otherwise. The function NEQ can be 
computed exactly by a polynomial of degree 0(log R ). Therefore, the polynomial 

has degree 0(log II) and approximates ED m,r to within error 1 — 1/M 2 . □ 
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